{"id":"CVE-2026-107181","published":"2026-10-07T14:17:08.807","lastModified":"2026-10-07T17:16:53.520","description":"Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwes":["CWE-143"],"vendors":[],"products":[],"references":[{"url":"https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/core/sandbox.cpp#L362-L364","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/support/support_helper.cpp#L673-L751","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9","tags":[]},{"url":"https://www.vulncheck.com/advisories/telegram-desktop-before-7.2.9-ipc-record-injection-file-exfiltration-via-interpret-scheme","tags":[]}],"exploitRefs":[{"url":"https://github.com/telegramdesktop/tdesktop","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/core/sandbox.cpp#L362-L364","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/support/support_helper.cpp#L673-L751","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","tags":[]},{"url":"https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9","tags":[]}],"hasPoc":true,"ai":{"summary":"Telegram Desktop before 7.2.9 has an IPC record-separator injection vulnerability that allows attackers to inject OPEN: records via unescaped semicolons in tg:// links, enabling remote file upload and account takeover.","exploitability":"The vulnerability is easily exploitable as it requires only a user to click a crafted tg:// link with unescaped semicolons, making it a simple phishing or social engineering attack vector.","blast_radius":"The impact could be significant as compromised Telegram accounts can lead to unauthorized access to sensitive communications and potential lateral movement within organizations that use Telegram for business purposes.","remediation":"Upgrade to Telegram Desktop 7.2.9 or later to remediate the IPC record-separator injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ipc","sandbox","session-key"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:58:47.324Z"}}